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Abstract — Corrupted frames with CRC errors potentially pro- 
vide a useful channel through which we can transmit information. 
Using measurements taken in an outdoor environment, we 
demonstrate that for 802.11 wireless links the channel provided 
by corrupted frames alone (i.e. ignoring frames with PHY errors 
and frames received correctly) can be accurately modelled as a 
binary symmetric channel (BSC) provided appropriate pre- and 
post- processing is carried out. Also, the channel provided by 
corrupted frames and other frames combined can be accurately 
modelled as a hybrid binary symmetric/packet erasure channel. 
Importantly, we find that this hybrid channel offers capacity 
increases of more than 100% compared to a conventional packet 
erasure channel over a wide range of RSSIs. This is a striking 
observation as it indicates that the potential exists for significant 
network throughput gains if the information contained in 802.11 
corrupted packets is exploited. 



I. Introduction 

Frames sent over an 802.11 wireless link may be received 
(i) with a PHY error, where the PHY header is corrupted 
by noise/interference and the receiver cannot demodulate the 
frame, or (ii) with a CRC error, where the PHY header is 
received correctly and the frame is decoded but then fails a 
CRC check or (iii) without error. The resulting information 
channel is often modelled as a packet erasure channel. That 
is, frames are received in an "all or nothing" fashion with 
frames having PHY or CRC errors being discarded and only 
frames received without error retained. However, the fraction 
of incorrect bits in frames with CRC errors can be small. 
For example, Fig. [T] shows experimental measurements of the 
fraction of corrupted bits in frames with CRC errors on an 
802.11 link (see Section Hl-AI for details of the experimental 
setup). It can be seen that even when the frame error rate (FER) 
is high (91.98% of frames fail the PHY header check or the 
CRC check), most of the frames received with CRC errors 
have less than 10% of bits incorrect. Thus, these corrupted 
frames potentially provide a useful channel through which we 
can transmit information. 

Taking this observation as our starting point, in this paper 
our aim is to characterise the information channel provided 
by 802.11 frame transmissions. Using measurements taken 
in an outdoor environment, we demonstrate that the channel 
provided by corrupted frames alone (i.e. ignoring frames 
with PHY errors and frames received correctly) can be ac- 
curately modelled as a BSC provided appropriate pre- and 
post- processing is carried out. Also, the channel provided by 
corrupted frames and other frames combined can be accurately 
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Fig. 1. Measured fraction of incorrect bits vs frame sequence number. 
Measurements taken outdoors in an open space with onmidirectional antennas 
at transmitter and receiver, 802.1 lg PHY rate 54Mbps. FER = 91.98%. 



modelled as a hybrid binary symmetric/packet erasure channel. 
We calculate the capacity of this channel and show that the 
potential exists for significant throughput gains. 

II. Preliminaries 
A. Experimental setup 

Experimental data was collected in an open outdoor space. 

1) Hardware and Software: An Asus Eee PC 4G 
Surf equipped with Atheros AR5BXB63 802.11b/g chipsets 
(AR2425, MAC 14.2, RF5424, PHY 7.0) was used as the 
access point, running FreeBSD 8.0 with the RELEASE kernel 
and using the standard FreeBSD ATH driver. A Fujitsu E series 
Lifebook equipped with a Netgear dual band 802.11a/b/g 
wireless PC card WAG511 using Atheros AR5212 chipset 
was used as a client station, running Ubuntu 11.04 with the 
RELEASE kernel and using a modified Linux Madwifi driver. 

We disabled the Atheros' Ambient Noise Immunity feature 
which has been reported to cause unwanted side effects (T]. 
Transmission power of the laptops was fixed and antenna di- 
versity disabled. In previous work we have taken considerable 
care to confirm that with this hardware/software setup the 
wireless stations accurately follow the IEEE 802.11 standard, 
see |2), 0, JT] for further details. 

A perl script was used to generate CBR UDP traffic. The 
content of each UDP packet was a random binary vector. 
Unless stated otherwise, the UDP payload is 8000 bits, and 
the inter-packet interval is 20 ms. Packets were transmitted 
over the WLAN in the broadcast mode and hence there were 
no MAC level ACKs or retransmissions. The wireless driver 
at the receiver was modified to record the receiving status for 
frames with PHY errors, CRC errors or without errors and to 
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transfer the contents of these from the kernel to user space via 
the high-speed data relay filesystem (relayfs). 

2) Recovering sequence number for corrupted frames: 
Frames received with CRC errors were compared against the 
corresponding original content in order to determine which 
specific bits inside the frame were received corrupted. Since 
the frame header might also be corrupted, the following fitting 
and pattern matching procedure was used to indirectly recover 
the frame sequence number. For each corrupted frame we 
first searched the set of correctly received frames to find the 
packet received without error closest in time to the corrupted 
frame. Since the frames are transmitted at a fixed rate, the 
interval between two consecutive frame timestamps is roughly 
constant, but to correct for clock skew between transmitter 
and receiver it is necessary to estimate the relative clock 
rate and offset. We estimated these using linear least squares 
fitting of the received timestamps of neighbouring error-free 
frames. The timestamp of the corrupted frame was then used 
to determine likely candidates for this frame amongst the 
transmitted frames. From this set of candidates, the sequence 
number and payload of each was compared with that of the 
corrupted frame in order to identify the transmitted frame most 
likely to correspond to the received corrupted frame. 

B. Runs Test 

Our statistical analysis makes use of the runs test (also 
called the Wald-Wolfowitz test) [7|. The runs test is a non- 
parametric test to check the null hypothesis that the elements 
in a two-valued sequence are independent and identical dis- 
tributed. Given a 0-1 sequence, a run is consecutive entries 
having the same value e.g. in the sequence 1100110111 there 
is one run, one 00 run, two 1 1 runs and one 111 run. Under 
the null hypothesis, the number of runs is a random variable 
whose conditional distribution is approximately normal with 
mean n = 2 N ^ N ° + 1 and variance a 2 = (/J ~^~ 2) where 
Ni is the number of 1 values in the sequence, No the number 
of values and N = Ni + Nq. Unless otherwise states we 
carry out statistical testing at the 5% significance level. 

III. Channel modelling 

We proceed by first investigating the channel provided by 
corrupted frames alone i.e. ignoring frames with PHY errors 
and frames received correctly. We find that, to within statistical 
error, this can be accurately modelled as a BSC. We then 
consider the channel provided by corrupted frames and other 
frames combined. We find that this can be accurately modelled 
as a hybrid binary symmetric/packet erasure channel. 

A. Channel provided by corrupted frames 

A binary symmetric channel (BSC) takes binary input 
X £ {0, 1} and maps this to binary output Y £ {0, 1}. With 
probability 1 — p the channel transmits the input bit correctly 
and with crossover probability p the input bit is flipped. That 
is, ¥{Y = 1\X = 1} = 1 - p = ¥{Y = 0\X = 0} and 
P{Y = 0\X = 1} = p = P{Y = l\X = 0}. Repeated binary 
channel uses are independent and identically distributed. That 
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Fig. 2. Per-bit error frequency pattern across a frame before and after 
interleaving, outdoor, FER = 0.5658, PHY rate 54Mbps, 5000 frames. 

is, if a binary vector is transmitted through a BSC, each bit is 
flipped independently and with identical crossover probability 
p. Therefore, to establish that a channel taking binary inputs 
is a BSC, we need to show 

(1) Repeated binary channel uses are independent and iden- 
tically distributed (i.i.d.). 

(2) The probability that a 1 is flipped to a after transmission 
is the same as the probability that a is flipped to a 1 
i.e. the binary channel is symmetric. 

1) Binary channel uses are i.i.d.: We begin by presenting 
raw experimental measurements in Fig. |2(a)| This figure plots 
representative measurements of the bit error frequency for each 
bit position within a corrupted frame. It can be seen that bit 
errors are not evenly distributed and the bit error frequency 
sequence is periodic across a frame. This observation is not 
new, e.g. see [4|, [5 1, |6], and clearly violates the independence 
requirement of a BSC. Nevertheless, Fig. |2(b)| plots the bit 
error frequency for the same data after interleaving (randomly 
permuting the bits in each frame). Interleaving can be readily 
implemented at the MAC layer - bits in a frame are permuted 
at the transmitter before a MAC frame goes down to the PHY 
layer and when the frame is received the inverse permutation 
is used to recover the original bit order. It can be seen from 
Fig. |2(b)| that after interleaving the periodicity of bit errors 
appears to be removed, although further analysis is required 
to confirm this. 

To analyse the independence of repeated channel uses within 
each individual interleaved frame we use the runs test. For 
each corrupted frame we construct a 0-1 sequence by labelling 
corrupted bits as l's and correct bits as 0's. We find that 
the runs test cannot reject the null hypothesis at the 5% 
significance level that after interleaving bit errors inside a 
frame are independent. That is, to within statistical error we 
can conclude that repeated channel uses inside each interleaved 
frame are independent and Bernoulli distributed with the bit 
crossover probability p — n c /l, where n c is the number of 
corrupted bits within a frame and I is the frame length. 

Next, to analyse the independence of channel uses across 
multiple frames we concatenate the foregoing binary se- 
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Fig. 3. Per-frame bit crossover probability for a sequence of 10000 packets, 
PHY rate 54Mbps, FER = 0.0423. 




Fig. 5. Hybrid BSC/packet erasure channel model. 



to each other , and thus, to within experimental error, can be 
approximately considered as "symmetric". 

In summary, after interleaving the bit errors in corrupted 
frames are, to within statistical error, independent and iden- 
tically distributed with a symmetric crossover probability, i.e. 
the information channel provided by these corrupted frames 
can be accurately modelled as a BSC. 



B. Hybrid Binary Symmetric/Packet Erasure Channel 



Fig. 4. Mean segment duration versus FER at different PHY rates. 

quences for successive corrupted frames and apply the runs 
test. For example, Fig. [3] plots the measured per-frame bit 
crossover probability for a sequence of 10,000 frames. Con- 
secutive corrupted frames that pass the runs test are labelled 
using the same marker. It can be seen that the experimental 
run is partitioned into three segments. Within each segment, 
corrupted frames form a bit-level channel over which re- 
peated channel uses can be considered to be independent 
and Bernoulli distributed to within statistical error. The first 
segment spans 3865 frames (around 77.3s given that the inter- 
packet interval is 20ms) and the third segment spans 6118 
frames (about 122.36s). The second segment has only one 
frame with an unusually high crossover probability. Neglecting 
this single bad frame out of 10,000 frames, the measurement 
results indicate that for long periods the sequence of corrupted 
frames form a bit-level channel over which repeated channel 
uses can be considered to be i.i.d. The data in Fig. [3] is for 
a FER of 0.0423 and PHY rate of 54Mbps. Fig. 0] plots 
the mean of segment durations over an experimental run of 
10000 packets for a range of FERs and PHY rates. It can 
be seen that the segment duration tends to decrease as the 
FER increases i.e. the duration within which corrupted frames 
have an i.i.d. bit crossover probability becomes shorter as the 
FER increases. For FER's less than 20%, at all PHY rates the 
mean segment duration exceeds 10s. That is, for FER's less 
than 20% the binary channel provided by corrupted frames is 
i.i.d. for periods exceeding, on average, 10s. Such time-scales 
seem sufficient for most channel modelling purposes. 

2) Binary channel is symmetric: Table U reports the mea- 
sured bit flip rates for 1 values and values. Results are shown 
for a range of FER values and PHY rates. It can be seen 
that the bit flip probabilities for both l's and O's are close 



Our hypothesis is that the channel provided by 802.11 
frames can be accurately modelled as a mixed packet era- 
sure/binary symmetric channel. Formally, the channel takes an 
n-bit binary vector x 6 {0,1}" as input, and outputs received 
vector y £ {0, 1}™. The vector y can be received with three 
possible states: (i) (erased), (ii) x' (corrupted) and (iii) x 
(without error). Repeated channel uses are i.i.d. The proba- 
bility that a received vector is erased is F{y — 0} = r. The 
probability that a non-erased vector is received without error 
is P{y = x | y ^ 0} = s and so the probability that a vector 
is correctly received is ¥{y = x} = (1 — r)s. The probability 
that a vector is corrupted is P{y = x'} = (1 — r)(l — s). 
In a corrupted vector bits are flipped symmetrically and 
independently with crossover probability p. This channel is 
illustrated schematically in Fig. [5] 

We can relate this hybrid model to 802.11 by associating 
the input vectors with transmitted frames, erasures with PHY 
errors and corrupted vectors with CRC errors. To establish 
an equivalence we need to show that (i) frames are received 
with PHY errors, CRC errors and without error in an i.i.d. 
fashion, (ii) corrupted frames provide a BSC. We have already 
established (ii) in Section UlI-AI but it remains to establish (i). 

Our hypothesis is that PHY errors, CRC errors and frames 
received without errors are mutually independent across time. 
To investigate this hypothesis, we again use the runs test. We 
construct a 0-1 sequence by labelling frames received with 
PHY errors as a 1 and other frames as a 0, and then apply the 
runs test for each individual segment which passes the runs test 
for bit error independence check. Similarly, we do the same 
respectively for frames received with CRC errors and without 
errors. Fig. [6] plots the fraction of time in an experimental run 
of 10,000 frames within which the runs tests pass for a range 
of FERs and PHY rates. It can be seen that the runs tests pass 
over at least 80% of the time in each experimental run, i.e. in 
an experimental run of 10,000 frames over 80% of the time, to 
within statistical error, frames are received with PHY errors, 
CRC errors and without error in an i.i.d. fashion. 
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TABLE I 

BIT FLIP RATES FOR l'S AND 0'S, Mi THE MEAN FLIP RATE OF BIT i , dil^/Wi THE standard deviation of flip rate of BIT i , Ni THE TOTAL 

NUMBER OF BIT i IN CORRUPTED FRAMES, = Nq + N\ . 
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Fig. 6. Fraction of time passing the runs test for PHY errors, CRC errors 
and good frames. 

IV. Conclusions 
The capacity of the hybrid channel is 

C = R(l-r) (s + (l-s)(l-H(p))) 

where H(p) is the entropy function of a Bernoulli (p) random 
variable, i.e. H(p) — —p\og 2 (p) — (1 — p) log 2 (l —p) and R 
is the PHY bit rate. 

Using our experimental data, we binned frames according 
to their RSSI (Received Signal Strength Indication) and calcu- 
lated the measured crossover probability in corrupted frames 
and the frame error rate. As we could not measure the RSSI 
for PHY erasures using our hardware, we do not include 
these here. Fig. [7] shows the resulting measured capacity 
vs RSSI. For comparison we also plot the experimentally 
measured packet erasure channel capacity i.e. the capacity 
when corrupted frames are discarded. It is important to note 
that these measured curves cannot be directly compared with 
theoretical calculations since the mapping between RSSI and 
SNR is not well defined. It can be seen that the capacity of 
the hybrid channel is strictly greater than the erasure channel 
capacity, as expected. More interestingly, it can be seen that the 
hybrid channel offers capacity increases of more than 100% 



Fig. 7. Outdoor experimental channel capacity 

over a wide range of RSSIs. This is a striking observation 
as it indicates that the potential exists for significant network 
throughput gains if the information contained in corrupted 
packets is exploited. 
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